Ladela vulnerabilities
We track 6 vulnerabilities in Ladela products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 10, 2026.
Latest Ladela vulnerabilities
- 7.2 High severity
Online Scheduling and Appointment Booking…: Deserialization of Untrusted Data
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for aut
- 9.1 Critical severity
Online Scheduling and Appointment Booking…: Authorization Bypass Through User-Controlled Key
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to t
- 7.5 High severity
Online Scheduling and Appointment Booking…: Authorization Bypass Through User-Controlled Key
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.1 via the 'conversation_id' parameter due to missing validation on a user controlled k
- 7.2 High severity
Online Scheduling and Appointment Booking…: Improper Neutralization of Input During Web Page Generation
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action in all versions up to, and including, 27.7 due to insufficient input sanitization and
- 7.5 High severity
Online Scheduling and Appointment Booking…: Improper Neutralization of Special Elements used in an SQL Command
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter an
- 7.2 High severity
Online Scheduling and Appointment Booking…: Improper Neutralization of Input During Web Page Generation
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookly-customer-full-name' cookie in versions up to, and including, 27.2 due to insufficient input sanitization and output